Medium Severity
CVE-2026-119977
Published: Nov 9, 2026
Technical deep-dives and root cause analyses of recently disclosed CVEs - reverse engineering patches, building proof-of-concepts, and documenting exploitation techniques in the 1-day window.
<div align="center">
<picture>
<img src="https://1dayexploit.com/assets/Logo-PNG.png" alt="1dayexploit" width="200" />
</picture>
# 1dayexploit - archive
**Technical deep-dives and root cause analyses of recently disclosed CVEs.**
[](https://1dayexploit.com)
</div>
---
## About
This repository collects technical write-ups of recently disclosed CVEs — the 1-day window between patch release and widespread exploitation.
Each analysis contains:
- Affected product, vendor, and version range
- Patch diff and root cause analysis
- Proof-of-concept demonstrating the vulnerability
- Detection guidance for defenders
- References to the original disclosure
---
## Analyses
| CVE | Vendor | Product | Class | Severity | Write-up |
|-----|--------|---------|-------|----------|----------|
| `CVE-2026-96677` | Apache Software Foundation | Apache Juneau 9.2.0 and earlier | Reflected XSS | Critical | [Read](./analyses/cve-2026-96677-apache-juneau-xss/) |
| `CVE-2026-123158` | OpenSSH Project | OpenSSH portable < 10.6p2 (musl libc, without PAM) | Authentication Bypass | High | [Read](./analyses/cve-2026-123158-openssh-sshhole-auth-bypass/) |
| `CVE-2026-117691` | Red Hat | Keycloak 26.8.1 and earlier | Authentication Bypass | Critical | [Read](./analyses/cve-2026-117691-keycloak-saml-auth-bypass/) |
| `CVE-2026-93389` | LiteSpeed Technologies | LiteSpeed Cache 7.9.0-7.9.1 | Info Disclosure | High | [Read](./analyses/cve-2026-93389-litespeed-cache-leak/) |
| `CVE-2026-119977` | Automattic | WordPress Core 4.7.0 - 7.1.3 | Predictable Web-Accessible Staging Directory / RCE | High | [Read](./analyses/cve-2026-119977-wordpress-core-rce/) |
| `CVE-2026-121802` | Better Auth | @better-auth/expo 1.4.0-beta.6 to 1.7.15 | Authentication Bypass | Critical | [Read](./analyses/cve-2026-121802-better-auth-account-takeover/) |
| `CVE-2026-88811` | SUSE | Rancher Manager 2.11.0-2.15.2 | Information Disclosu